The Hague, 1 October 2026
KillSec has been around since 2024. By exploiting poorly secured access points, particularly those linked to cloud storage, the group was able to gain access to organisations’ systems. Once inside, the KillSec group stole data and copied it to their own infrastructure. They then threatened to make the stolen data public unless the victims paid a ransom. If the victims did not pay, the stolen files were made available for free download. To prove that they possessed the stolen data, victims would get sent samples. In some cases, the group received substantial ransom payments.
Authorities have identified other suspects in different roles, including administrator, developer, negotiator and affiliate. A teenager is suspected of being the group’s administrator and main operator. Other suspects include a developer who recently turned 18 and was a minor when a number of the alleged offences were committed. The group made itself known online by using aliases concealing their true identities. To communicate they used encrypted messaging services.
Eurojust coordinated judicial authorities from Belgium, Finland, Germany, Greece, Romania, Spain, Switzerland, the United Kingdom and the United States. A joint investigation team was set up at Eurojust between authorities from Belgium, Germany, Greece and Romania. All nine authorities worked together to identify suspects, locate the group’s infrastructure and follow financial trails. The authorities came together at Eurojust to plan an international action day involving the identification of suspects and the seizure of evidence and assets. The action day was run from a coordination centre set up at Eurojust.
Europol produced reports on the group’s activities, connected investigators with private-sector partners and provided specialist support to trace cryptocurrency and examine digital evidence.
The action day resulted in the arrests of three suspects and the seizure of evidence and assets. Eight house searches were carried out in Spain, Greece, the United Kingdom and Romania. They were able to secure at least 110 terabytes of stolen data. During the investigation, authorities seized five servers used by the group to store data from its victims. Authorities also seized domains operated by KillSec.
Authorities will now continue their investigation by examining the seized devices and data and tracing the group’s financial proceeds. This evidence may help to identify other victims, attacks and people involved.
The actions were carried out by the following authorities:
- Belgium: Public Prosecutor’s Office Brussels; Federal Computer Crime Unit
- Finland: National Bureau of Investigation
- Germany: Public Prosecutor’s Office Hamburg; Federal Criminal Police Office; Hamburg State Criminal Police Office
- Greece: Judicial authorities; Hellenic Police
- Romania: Prosecution Office attached to the High Court of Cassation and Justice, Directorate for Investigation of Organised Crime and Terrorism – Central Office; Romanian Police – Directorate for Combating Organised Crime
- Spain: Investigative Court number 20 of Barcelona; Public Prosecutor’s Office Barcelona; Mossos d’Esquadra; Guardia Civil
- Switzerland: Office of the Attorney General of Switzerland (OAG); Federal Office of Police fedpol
- United Kingdom: Eastern Region Special Operations Unit (ERSOU)
- United States: United States Attorney’s Office for the District of Puerto Rico; Federal Bureau of Investigation, San Juan Field Office
